NAVTOR NavBox versions up to 4.16.1.20 contain hard‑coded credentials embedded in the Windows Communication Foundation (WCF) SOAP interface. A local attacker who can access the machine can extract these credentials and authenticate against the SOAP endpoint. Once authenticated, the attacker gains access to privileged WCF methods that enable writing or overwriting files in application‑defined directories, effectively allowing them to modify critical application data or configurations. This vulnerability is a classic example of CWE‑798, where hard‑coded passwords undermine authentication security and can be leveraged for local privilege escalation.

The affected product is NAVTOR NavBox. All releases up to and including 4.16.1.20 are impacted. NAVTOR has provided a patch in version 4.17.2.6 and later, and systems that maintain an active NavBox connection will automatically receive the update; no manual action is required for those instances.

The CVSS score for this flaw is 5.8, indicating moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to the host or the ability to communicate with the SOAP interface, which is typically restricted to local network or privileged users. Attackers with such access could elevate their privileges to write arbitrary files within the application’s boundaries. The patch mitigates the issue, thus the risk is reduced for systems that have applied the update.